A physician who discovers a Medicare overpayment faces a decision that carries consequences well beyond the dollar amount at issue. Federal law requires providers to report and return an identified overpayment within 60 days, and treats a knowingly retained overpayment as a false claim in its own right. But the 60-day refund is only one of three tracks. When the overpayment traces to a kickback or fraud-adjacent billing pattern, the Office of Inspector General's Self-Disclosure Protocol is the safer route. When it traces to a self-referral arrangement, only the Centers for Medicare & Medicaid Services' Self-Referral Disclosure Protocol resolves the underlying Stark Law violation. Choosing the wrong track can leave exposure the physician thought was closed.
The 60-Day Refund Rule Under 42 CFR 401.305
The baseline obligation sits in 42 CFR 401.305. A provider that has received a Medicare overpayment must report and return it within 60 days of the date the overpayment was identified, or by the date any related cost report is due, whichever is later. Under a definition CMS revised effective January 1, 2025, a provider has identified an overpayment when it knowingly receives or retains it. The obligation reaches back six years. If the physician is investigating whether related claims share the same cause, the 60-day clock can pause for up to 180 days. Retaining an identified overpayment past the deadline creates an obligation under the reverse false claims provision, 31 U.S.C. § 3729(a)(1)(G), turning a billing error into a False Claims Act matter.
The OIG Self-Disclosure Protocol for Kickback Exposure
When the overpayment traces to a kickback arrangement, a false certification, or other conduct that could expose the physician to civil monetary penalties or program exclusion, a refund alone does not resolve that exposure. The Office of Inspector General's Self-Disclosure Protocol is built for that scenario. OIG's general practice is to resolve accepted disclosures at 1.5 times single damages, well below the treble damages and per-claim penalties available under the False Claims Act, and to require a minimum settlement of $100,000 for kickback-related matters and $20,000 for other matters. Physicians who use the protocol also gain a presumption against exclusion from federal healthcare programs, an outcome a simple refund does not touch.
The CMS SRDP for Stark Law Violations
A financial relationship that fails a Stark Law exception calls for a third path. CMS created the Self-Referral Disclosure Protocol under Section 6409 of the Affordable Care Act to resolve actual or potential Stark violations, and only CMS, not OIG, has authority to reduce what is owed on a Stark-only overpayment. Once CMS acknowledges an SRDP submission, the 60-day refund deadline is suspended for the disclosed conduct. CMS then decides whether to reduce the settlement based on the nature of the violation, the timeliness of the disclosure, and the physician's cooperation, factors that reward disclosing before a Medicare audit contractor finds the same pattern.
Self-disclosure only closes the exposure it actually resolves. A Stark violation disclosed through the wrong protocol can leave the underlying kickback or refund exposure wide open.
Choosing Between the Three Tracks
Mixing the three tracks leaves gaps. A refund alone leaves kickback and exclusion exposure open because it addresses the dollar amount, not the underlying conduct. OIG generally declines Stark-only submissions and redirects the physician to the CMS protocol, since only CMS can resolve a self-referral violation. A physician who spends weeks deciding which path to take is running the 60-day and 180-day clocks the entire time. If a Recovery Audit Contractor identifies the same overpayment first, the physician loses the benefit of self-disclosure and faces a recoupment demand instead of a negotiated settlement, and a documentation gap traced to one local coverage determination can be extrapolated across the full claims sample once the government controls the timeline.
Why Early Legal Counsel Is Critical
It is critical that physicians promptly retain experienced healthcare defense counsel before choosing among these three tracks. Early legal intervention can determine which protocol actually resolves the underlying exposure, keep the disclosure itself from creating new admissions, and let counsel communicate with OIG or CMS on the physician's behalf throughout the review. Physicians who are still deciding whether counsel is necessary should review our companion piece on when to engage a Medicare audit attorney; the deadlines above do not pause while that decision gets made.
How Health Law Alliance Can Help
Health Law Alliance advises physicians on which of these three tracks fits a given overpayment, and carries the disclosure through OIG or CMS once that choice is made. Our bench includes a former federal prosecutor and a former senior healthcare compliance executive, background that shapes how we evaluate whether a self-disclosure closes the exposure or leaves part of it open. If your practice has identified a Medicare overpayment, contact us for a free, confidential consultation before the 60-day clock runs.
